CN111061586A - Container cloud platform anomaly detection method and system and electronic equipment - Google Patents
Container cloud platform anomaly detection method and system and electronic equipment Download PDFInfo
- Publication number
- CN111061586A CN111061586A CN201911233197.2A CN201911233197A CN111061586A CN 111061586 A CN111061586 A CN 111061586A CN 201911233197 A CN201911233197 A CN 201911233197A CN 111061586 A CN111061586 A CN 111061586A
- Authority
- CN
- China
- Prior art keywords
- real
- similarity
- weight
- time
- structure chart
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/07—Responding to the occurrence of a fault, e.g. fault tolerance
- G06F11/0703—Error or fault processing not based on redundancy, i.e. by taking additional measures to deal with the error or fault not making use of redundancy in operation, in hardware, or in data representation
- G06F11/0706—Error or fault processing not based on redundancy, i.e. by taking additional measures to deal with the error or fault not making use of redundancy in operation, in hardware, or in data representation the processing taking place on a specific hardware platform or in a specific software environment
- G06F11/0709—Error or fault processing not based on redundancy, i.e. by taking additional measures to deal with the error or fault not making use of redundancy in operation, in hardware, or in data representation the processing taking place on a specific hardware platform or in a specific software environment in a distributed system consisting of a plurality of standalone computer nodes, e.g. clusters, client-server systems
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F18/00—Pattern recognition
- G06F18/20—Analysing
- G06F18/22—Matching criteria, e.g. proximity measures
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F9/00—Arrangements for program control, e.g. control units
- G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
- G06F9/44—Arrangements for executing specific programs
- G06F9/455—Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
- G06F9/45533—Hypervisors; Virtual machine monitors
- G06F9/45558—Hypervisor-specific management and integration aspects
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F9/00—Arrangements for program control, e.g. control units
- G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
- G06F9/44—Arrangements for executing specific programs
- G06F9/455—Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
- G06F9/45533—Hypervisors; Virtual machine monitors
- G06F9/45558—Hypervisor-specific management and integration aspects
- G06F2009/45591—Monitoring or debugging support
Abstract
The application relates to a container cloud platform anomaly detection method and system and electronic equipment. The method comprises the following steps: step a: inputting an initial authorized structure chart of an application cluster, and constructing a real-time authorized structure chart of the application cluster; step b: judging whether the real-time authorized structure chart of the application cluster is similar to the chart structure of the initial authorized structure chart or not, and if so, executing the step c; otherwise, returning the abnormal information of the application cluster structure; step c: and judging whether the weight similarity of the real-time weighted structure chart of the application cluster at the current moment and the weighted structure chart of the last sampling point is greater than a set similarity threshold, if not, screening the sides with the weight similarity less than the similarity threshold, marking abnormal components in the real-time weighted structure chart at the current moment, and returning the marked real-time weighted structure chart to a cluster manager. The method and the device improve the real-time performance of structural abnormality detection and improve the speed and accuracy of functional abnormality positioning.
Description
Technical Field
The application belongs to the technical field of cloud computing, and particularly relates to a container cloud platform anomaly detection method and system and electronic equipment.
Background
Cloud computing has gained favor in the industry and academia as a new service providing method. The key technology of cloud computing is virtualization technology, and by virtualizing various resources, a cloud computing service provider can conveniently customize and deliver various resources to users for use, and numerous applications gradually start to migrate into a cloud computing cluster. Conventional virtualization technologies include KVM, Xen, etc. However, the traditional virtualization technology is too cumbersome and complicated to create, modify and migrate a certain component in an application cluster, so that cloud computing service providers need a more lightweight virtualization technology.
Container technology is a lightweight operating system level virtualization technology. As container technology has matured, a cloud service platform based on container technology (hereinafter referred to as container cloud) has begun to gradually replace a traditional cloud service platform based on virtual machines. Compared with the traditional virtualization technology for the virtualization of a hardware layer, the virtualization of the container is stopped at an operating system layer, so that the container is convenient and fast to create, modify and migrate, and meanwhile, the overhead caused by the virtualization is also obviously reduced. Because the container has the characteristics of lightweight, the deployment of container is more convenient. A large number of application programs utilize the container to isolate different services in the application programs, and due to the characteristics of the container, users can conveniently and quickly update and maintain, create and destroy different types of services in the application programs. This results in a complex and rapidly changing internal structure of the vessel cloud. Secondly, the isolation of the containers is poor, and when a plurality of containers are operated on the same physical host, strong interference is easily generated among the containers. Once an exception occurs in a container in the container cloud, the exception is quickly propagated to the whole cluster, and different micro-services are further influenced.
A cloud service platform based on container technology is generally composed of a large number of physical machines, and each physical machine typically runs hundreds of containers. Since the container is deployed on the operating system in a running state, a failure of the physical machine may also cause an exception to the container deployed thereon. The existing abnormal detection positioning scheme utilizes performance index data to carry out abnormal detection and positioning, and brings great storage and transmission expenses. Meanwhile, a normal fluctuation model needs to be constructed, and due to the complex internal environment of the container cloud, real-time dynamic analysis is seriously lacked for a container cloud platform with frequent and complex fluctuation, so that a method capable of rapidly and abnormally positioning an application micro-service cluster with a complex structure built through a container needs to be provided.
Disclosure of Invention
The application provides a method, a system and an electronic device for detecting the abnormity of a container cloud platform, and aims to solve at least one of the technical problems in the prior art to a certain extent.
In order to solve the above problems, the present application provides the following technical solutions:
a container cloud platform anomaly detection method comprises the following steps:
step a: inputting an initial authorized structure chart of an application cluster, and constructing a real-time authorized structure chart of the application cluster;
step b: judging whether the real-time authorized structure chart of the application cluster is similar to the chart structure of the initial authorized structure chart or not, if so, considering the application cluster structure to be normal, and executing the step c; otherwise, returning the abnormal information of the application cluster structure;
step c: calculating the weight similarity of the real-time weighted structure chart of the application cluster at the current moment and the weighted structure chart of the last sampling point, judging whether the weight similarity is greater than a set similarity threshold value, if so, returning to the step b to continuously judge whether the real-time weighted structure chart at the current moment is similar to the graph structure of the initial weighted structure chart; otherwise, executing step d;
step d: and screening the sides with the weight similarity smaller than the similarity threshold, marking abnormal components in the real-time weighted structure chart at the current moment, and returning the marked real-time weighted structure chart to a cluster manager.
The technical scheme adopted by the embodiment of the application further comprises the following steps: in the step a, the constructing a real-time authorized structure diagram of the application cluster specifically includes: and collecting calling information and response time among all server components in the application cluster and resource use information of the application components, and constructing a real-time authorized structure chart of the application cluster according to the calling information and the response time among all the server components and the resource use information of the application components.
The technical scheme adopted by the embodiment of the application further comprises the following steps: in the step a, the construction method of the real-time authorized structure diagram of the application cluster specifically includes:
step a 1: acquiring information of an application service component requesting to call a network card, recording a destination IP address requested by the service component when the network card is called by the service component, and recording a destination IP and a source IP;
step a 2: recording destination IP (dIP) and source IP (sIP) information, and respectively converting the destination IP and the source IP into a destination host name and a source host name according to host information, namely recording the names of service components as dName and sName respectively;
step a 3: adding service components represented by a target IP and a source IP into a real-time weighted structure diagram as vertexes, constructing structure diagram edge weight key value pairs < (sName: dName) > (latency: 0, CPU:0, mem:0, disk:0 and net: 0), representing that the connection of nodes of two service components is normal, wherein { latency:0, CPU:0, mem:0, disk:0 and net:0} represent edge weights, latency represents response time between the service components, CPU represents the CPU average utilization rate of the service components in a sampling period, mem represents the average utilization rate of a memory, disk represents the average disk read-write rate, and net represents the average network IO rate;
step a 4: recording service response time between the service component and a service component requested by the service component, taking the response time as a weight of the service component and the service component requested by the service component, replacing latency information of a middle weight of a real-time graph edge weight key value pair with a weight structure, acquiring resource use information of the service component by using a dockerAPI, and replacing CPU, mem, disk and net information of the middle weight of the key value pair;
step a 5: and returning the real-time graph edge weight key value pair with the weight structure to the main node.
The technical scheme adopted by the embodiment of the application further comprises the following steps: in the step b, the determining whether the graph structures of the real-time authorized structure graph and the initial authorized structure graph of the application cluster are similar specifically includes:
step b 1: extracting the side information (sName: dName) in the side weight key value pair provided by each service component;
step b 2: sequencing the side information according to the source host name sName;
step b 3: comparing the sequencing result of the side information with a side information sequence in the initial structure drawing with the right, judging whether the source host and the target host do not correspond one by one, if so, returning the information of the sides of the cluster with abnormal structures and different from the initial structure drawing with the right; otherwise, returning the normal information of the cluster structure.
The technical scheme adopted by the embodiment of the application further comprises the following steps: in the step c, the determining whether the weight similarity is greater than a set similarity threshold specifically includes:
step c 1: and (3) setting the weight information omega in the edge weight key value pair provided by each service component as { latency:0, CPU:0, mem:0, disk:0, net:0, extracting;
step b 2: calculating the similarity between the real-time weighted structure diagram at the current moment and the weighted structure diagram of the last sampling point, wherein the calculation formula is as follows:
in the above formula, G1，G2Respectively showing a real-time weighted structure chart of the current moment and a weighted structure chart of a last sampling point,
e represents G1And G2And concentrated edge, ω1，ω2Indicating that the edges e are respectively at G1And G2The weight value in (1);
step b 3: judging whether the similarity between the real-time weighted structure diagram at the current moment and the weighted structure diagram at the last sampling point is greater than a set similarity threshold value, if the last sampling point is the initial moment, or if the similarity is greater than the set similarity threshold value, judging whether the similarity is greater than the set similarity threshold value or not, if the similarity is greater than the set similarity threshold value, judging whether the similarity is greater1，G2) If the similarity is greater than the set similarity threshold, returning the information that the weight is normal; if Sim (G)1，G2) And if the similarity is less than the set similarity threshold, returning to the application cluster structure chart that the weight is abnormal, and returning to the side with the diff value less than the threshold.
Another technical scheme adopted by the embodiment of the application is as follows: a container cloud platform anomaly detection system, comprising:
an initialization module: the initial authorized structure chart is used for inputting an application cluster;
a structure diagram construction module: the real-time authorized structure chart is used for constructing an application cluster;
the graph structure similarity judging module: the weight similarity judging module is used for judging whether the real-time weighted structure chart of the application cluster is similar to the graph structure of the initial weighted structure chart, if so, the application cluster structure is considered to be normal, and the weight similarity of the real-time weighted structure chart is judged through the weight similarity judging module; otherwise, returning the abnormal information of the application cluster structure;
a weight similarity judgment module: the device is used for calculating the weight similarity between the real-time weighted structure diagram of the application cluster at the current moment and the weighted structure diagram of the last sampling point, judging whether the weight similarity is greater than a set similarity threshold value, and if so, continuously judging whether the real-time weighted structure diagram at the current moment is similar to the diagram structure of the initial weighted structure diagram through the diagram structure similarity judging module; otherwise, marking the abnormal component through an abnormal marking module;
an exception marking module: and the method is used for screening the sides with the weight similarity smaller than the similarity threshold, marking abnormal components in the real-time weighted structure chart at the current moment, and returning the marked real-time weighted structure chart to the cluster manager.
The technical scheme adopted by the embodiment of the application further comprises the following steps: the construction of the real-time authorized structure diagram of the application cluster by the structure diagram construction module specifically comprises the following steps: and collecting calling information and response time among all server components in the application cluster and resource use information of the application components, and constructing a real-time authorized structure chart of the application cluster according to the calling information and the response time among all the server components and the resource use information of the application components.
The technical scheme adopted by the embodiment of the application further comprises the following steps: the construction of the real-time authorized structure diagram of the application cluster by the structure diagram construction module specifically comprises the following steps:
acquiring information of an application service component requesting to call a network card, recording a destination IP address requested by the service component when the network card is called by the service component, and recording a destination IP and a source IP;
recording destination IP (dIP) and source IP (sIP) information, and respectively converting the destination IP and the source IP into a destination host name and a source host name according to host information, namely recording the names of service components as dName and sName respectively;
adding the service components represented by the target IP and the source IP into the real-time weighted structure diagram as vertexes, and constructing a structure diagram edge weight key value pair < (sName: dName): { latency:0, CPU:0, mem:0, disk:0, net:0} >, indicating that the node connection of two service components is normal, wherein { latency:0, CPU:0, mem:0, disk:0, net:0 represents the weight of the edge, latency represents the response time between service components, CPU represents the average CPU utilization rate of the service components in a sampling period, mem represents the average memory utilization rate, disk represents the average disk read-write rate, and net represents the average network IO rate;
recording service response time between the service component and the service component requested by the service component, taking the response time as a weight of the service component and the service component requested by the service component, replacing latency information of a middle weight of a real-time graph edge weight key value pair, acquiring resource use information of the service component by using dockeraPI, replacing CPU, mem, disk and net information of the middle weight of the key value pair, and returning the real-time graph edge weight key value pair of the right structure to the main node.
The technical scheme adopted by the embodiment of the application further comprises the following steps: the step of judging whether the graph structures of the real-time authorized structure graph and the initial authorized structure graph of the application cluster are similar by the graph structure similarity judgment module specifically comprises the following steps:
extracting the side information (sName: dName) in the side weight key value pair provided by each service component; sequencing the side information according to the source host name sName;
comparing the sequencing result of the side information with a side information sequence in the initial structure drawing with the right, judging whether the source host and the target host do not correspond one by one, if so, returning the information of the sides of the cluster with abnormal structures and different from the initial structure drawing with the right; otherwise, returning the normal information of the cluster structure.
The technical scheme adopted by the embodiment of the application further comprises the following steps: the step of judging whether the weight similarity is greater than the set similarity threshold by the weight similarity judging module specifically includes: and (3) setting the weight information omega in the edge weight key value pair provided by each service component as { latency:0, CPU:0, mem:0, disk:0, net:0, extracting; calculating the similarity between the real-time weighted structure diagram at the current moment and the weighted structure diagram of the last sampling point, wherein the calculation formula is as follows:
in the above formula, G1，G2Respectively showing a real-time weighted structure chart of the current moment and a weighted structure chart of a last sampling point,
e represents G1And G2And concentrated edge, ω1，ω2Indicating that the edges e are respectively at G1And G2The weight value in (1);
judging whether the similarity between the real-time weighted structure diagram at the current moment and the weighted structure diagram at the last sampling point is greater than a set similarity threshold value, if the last sampling point is the initial moment, or if the similarity is greater than the set similarity threshold value, judging whether the similarity is greater than the set similarity threshold value or not, if the similarity is greater than the set similarity threshold value, judging whether the similarity is greater1，G2) If the similarity is greater than the set similarity threshold, returning the information that the weight is normal; if Sim (G)1，G2) And if the similarity is less than the set similarity threshold, returning to the application cluster structure chart that the weight is abnormal, and returning to the side with the diff value less than the threshold.
The embodiment of the application adopts another technical scheme that: an electronic device, comprising:
at least one processor; and
a memory communicatively coupled to the at least one processor; wherein the content of the first and second substances,
the memory stores instructions executable by the one processor to cause the at least one processor to perform the following operations of the container cloud platform anomaly detection method described above:
step a: inputting an initial authorized structure chart of an application cluster, and constructing a real-time authorized structure chart of the application cluster;
step b: judging whether the real-time authorized structure chart of the application cluster is similar to the chart structure of the initial authorized structure chart or not, if so, considering the application cluster structure to be normal, and executing the step c; otherwise, returning the abnormal information of the application cluster structure;
step c: calculating the weight similarity of the real-time weighted structure chart of the application cluster at the current moment and the weighted structure chart of the last sampling point, judging whether the weight similarity is greater than a set similarity threshold value, if so, returning to the step b to continuously judge whether the real-time weighted structure chart at the current moment is similar to the graph structure of the initial weighted structure chart; otherwise, executing step d;
step d: and screening the sides with the weight similarity smaller than the similarity threshold, marking abnormal components in the real-time weighted structure chart at the current moment, and returning the marked real-time weighted structure chart to a cluster manager.
Compared with the prior art, the embodiment of the application has the advantages that: according to the container cloud platform anomaly detection method and system and the electronic device, structural similarity of the real-time authorized structure diagram of the application cluster is used for judging cluster structural anomaly, the number of times of similarity calculation is reduced, and the real-time performance of structural anomaly detection is improved. And judging whether the cluster function is abnormal or not by using the similarity of the weight values of the real-time structure chart of the application cluster, thereby improving the speed of positioning the function abnormality. According to the method and the device, the request response time is adopted for judging the abnormal state, so that the data acquisition overhead is reduced, and the instantaneity of judging the abnormal state is improved. Meanwhile, the interference between the assemblies and the interference between the physical machines and the assemblies are considered, and the abnormity is positioned from the two angles of the application cluster structure and the application cluster function, so that the accuracy of abnormity positioning is improved.
Drawings
Fig. 1 is a flowchart of a container cloud platform anomaly detection method according to an embodiment of the present application;
FIG. 2 is a schematic process diagram of constructing a real-time authorized architecture diagram of an application cluster;
FIG. 3 is a schematic diagram illustrating a process of determining whether the weighted structure diagrams of the application clusters are structurally similar;
FIG. 4 is a schematic diagram illustrating a process of determining whether the real-time weighted structure diagrams of the application clusters have similar weights;
FIG. 5 is a schematic structural diagram of a container cloud platform anomaly detection system according to an embodiment of the present application;
fig. 6 is a schematic structural diagram of hardware equipment of a container cloud platform anomaly detection method provided in an embodiment of the present application.
Detailed Description
In order to make the objects, technical solutions and advantages of the present application more apparent, the present application is described in further detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative of the present application and are not intended to limit the present application.
Please refer to fig. 1, which is a flowchart illustrating a method for detecting an anomaly of a container cloud platform according to an embodiment of the present application. The method for detecting the anomaly of the container cloud platform comprises the following steps:
step 100: inputting an initial weighted structure chart of the application cluster, and initializing a weight of the initial weighted structure chart;
in step 100, the structure and weight of the initial weighted structure diagram of the application cluster are provided by the deployer of the application program.
Step 200: collecting calling information and response time among server components in the application cluster and resource use information of the application components, and constructing a real-time authorized structure chart of the application cluster;
in step 200, the real-time authorized structure diagram reflects the state of the application program in the running process. The process of constructing the real-time authorized structure diagram of the application cluster is shown in fig. 2, all the service components of the application cluster concurrently execute the following process, and finally the real-time authorized structure diagram of the application cluster is constructed;
step 201: acquiring information of calling a network card by using an application service assembly request by using a perf monitoring tool, recording a destination IP address requested by the service assembly when the network card is called by the service assembly, and recording a destination IP and a source IP;
in the steps, the calling request of the service component to the network card is monitored by the perf monitoring tool, so that the construction cost of the component structure diagram can be reduced.
Step 202: collecting information returned to the upper layer of the application service assembly by the network card by using a per f monitoring tool, recording destination IP (dIP) and source IP (sIP) information, and respectively converting the destination IP and the source IP into a destination host name and a source host name according to host information, namely recording the names of the service assembly as dName and sName respectively;
step 203: adding service components represented by a target IP and a source IP into a real-time weighted structure diagram as vertexes, constructing structure diagram edge weight key value pairs < (sName: dName) > (latency: 0, CPU:0, mem:0, disk:0 and net: 0), representing normal connection of nodes of two service components, wherein { latency:0, CPU:0, mem:0, disk:0 and net:0} represent edge weights, mainly comprising five parts, wherein latency represents response time between the service components, CPU represents the CPU average utilization rate of the service components in a sampling period, mem represents the average utilization rate of a memory, disk represents the average disk read-write rate, and net represents the average network IO rate.
Step 204: recording service response time between the service component and a service component requested by the service component by using tcprstat, replacing latency information of a weight in a real-time graph edge weight key value pair with the response time as the weight of the service component and the service component requested by the service component, acquiring resource use information of the service component by using dockeraPI, and replacing CPU, mem, disk and net information in the key value pair.
Step 205: and returning the real-time graph edge weight key value pair with the weight structure to the main node.
In the steps, the accuracy of judging the similarity of the weight values of the application cluster real-time structure chart is improved by using the resource use information of the tcprstat and dockeraPI acquisition service assembly. And the response time and the resource utilization rate of the application components are stored in a key value pair form, so that the expandability of the anomaly detection system is improved.
Step 300: judging whether the real-time authorized structure chart of the application cluster is similar to the chart structure of the initial authorized structure chart, if so, considering the application cluster structure to be normal, and continuing to execute the step 400; otherwise, go to step 600;
in step 300, a process of determining whether the structure of the authorized structure diagram of the application cluster is similar is shown in fig. 3, which specifically includes the following steps:
step 301: extracting the side information (sName: dName) in the side weight key value pair provided by each service component;
step 302: sequencing the side information according to the source host name sName;
step 303: comparing the sequencing result of the side information with the side information sequence in the initial structure diagram with the right, judging whether the active host and the target host do not correspond one by one, and returning the information of the sides of the cluster with abnormal structures and different from the initial structure diagram with the right when finding that the active host and the target host do not correspond; otherwise, returning the normal information of the cluster structure.
In the foregoing, according to the characteristics of the structure diagram of the application cluster, the edges of the structure diagram are sorted according to the source host name, and the initial structure diagrams are compared one by one, so that the similarity judgment overhead of the component structure diagrams is remarkably reduced. The structural similarity of the real-time weighted structure chart of the application cluster is used for judging the cluster function abnormality, so that the similarity calculation times are reduced, and the instantaneity of abnormality detection is improved.
Step 400: calculating the weight similarity between the real-time weighted structure diagram of the application cluster at the current moment and the weighted structure diagram of the last sampling point, judging whether the weight similarity is greater than a set similarity threshold, and if so, returning to the step 300 to continuously judge whether the real-time weighted structure diagram at the current moment is similar to the diagram structure of the initial weighted structure diagram; otherwise, executing step 500;
in step 400, a process of determining whether the real-time weighted structure diagram of the application cluster has similar weights is shown in fig. 4, which specifically includes the following steps:
step 401: and (3) setting the weight information omega in the edge weight key value pair provided by each service component as { latency:0, CPU:0, mem:0, disk:0, net:0, extracting;
step 402: calculating the similarity between the real-time weighted structure diagram at the current moment and the weighted structure diagram at the last sampling point, and judging whether the similarity between the real-time weighted structure diagram at the current moment and the weighted structure diagram at the last sampling point is greater than a set similarity threshold value or not, if the last sampling point is the initial moment, or if the similarity is greater than the set similarity threshold value, obtaining the weighted structure diagram of the real-time weighted structure1，G2) If the similarity is greater than the set similarity threshold, go to step 403; if Sim (G)1，G2) If the similarity is less than the set similarity threshold, go to step 404;
in step 402, the similarity calculation method includes:
in the formula (1), G1，G2Respectively showing a real-time weighted structure chart of the current moment and a weighted structure chart of a last sampling point,
e represents G1And G2And concentrated edge, ω1，ω2Indicating that the edges e are respectively at G1And G2The weight value in (1).
Step 403: returning the information that the weight is normal;
step 404: and returning the abnormal weight value of the application cluster structure chart and returning the edge with the diff value smaller than the threshold value.
Step 500: marking an abnormal component; screening the sides with the weight similarity smaller than the similarity threshold, marking the sides in the real-time structure drawing at the current moment, and returning the marked real-time structure drawing with the weight to the cluster manager;
in step 500, the application judges whether the cluster function is abnormal by using the similarity of the weight values of the real-time authorized structure chart of the application cluster, and improves the speed of positioning the function abnormality.
Step 600: and returning the abnormal information of the application cluster structure.
Please refer to fig. 5, which is a schematic structural diagram of a container cloud platform anomaly detection system according to an embodiment of the present application. The container cloud platform anomaly detection system comprises an initialization module, a structure diagram construction module, a diagram structure similarity judgment module, a weight similarity judgment module and an anomaly marking module.
An initialization module: the initial weight structure chart is used for inputting the initial weight structure chart of the application cluster and initializing the weight of the initial weight structure chart; the structure and the weight of the initial weighted structure diagram of the application cluster are provided by a deployer of the application program.
A structure diagram construction module: the real-time authorized structure chart is used for collecting calling information and response time among all server components in the application cluster and resource use information of the application components and constructing the real-time authorized structure chart of the application cluster; the real-time authorized structure diagram reflects the state of the application program in the running process, and the construction process comprises the following steps:
1. acquiring information of calling a network card by using an application service assembly request by using a perf monitoring tool, recording a destination IP address requested by the service assembly when the network card is called by the service assembly, and recording a destination IP and a source IP;
2. collecting information returned to the upper layer of the application service assembly by the network card by using a per f monitoring tool, recording destination IP (dIP) and source IP (sIP) information, and respectively converting the destination IP and the source IP into a destination host name and a source host name according to host information, namely recording the names of the service assembly as dName and sName respectively;
3. adding service components represented by a target IP and a source IP into a real-time weighted structure diagram as vertexes, constructing structure diagram edge weight key value pairs < (sName: dName) > (latency: 0, CPU:0, mem:0, disk:0 and net: 0), representing normal connection of nodes of two service components, wherein { latency:0, CPU:0, mem:0, disk:0 and net:0} represent edge weights, mainly comprising five parts, wherein latency represents response time between the service components, CPU represents the CPU average utilization rate of the service components in a sampling period, mem represents the average utilization rate of a memory, disk represents the average disk read-write rate, and net represents the average network IO rate.
4. Recording service response time between the service component and a service component requested by the service component by using tcprstat, replacing latency information of a weight in a real-time graph edge weight key value pair with the response time as the weight of the service component and the service component requested by the service component, acquiring resource use information of the service component by using dockeraPI, and replacing CPU, mem, disk and net information in the key value pair.
5. And returning the real-time graph edge weight key value pair with the weight structure to the main node.
The graph structure similarity judging module: the real-time authorized structure chart is used for judging whether the real-time authorized structure chart of the application cluster is similar to the graph structure of the initial authorized structure chart or not, and if so, the application cluster structure is considered to be normal; otherwise, returning the abnormal information of the application cluster structure; the process of judging whether the structure of the authorized structure chart of the application cluster is similar comprises the following steps:
1. extracting the side information (sName: dName) in the side weight key value pair provided by each service component;
2. sequencing the side information according to the source host name sName;
3. comparing the sequencing result of the side information with the side information sequence in the initial structure diagram with the right, judging whether the active host and the target host do not correspond one by one, and returning the information of the sides of the cluster with abnormal structures and different from the initial structure diagram with the right when finding that the active host and the target host do not correspond; otherwise, returning the normal information of the cluster structure.
A weight similarity judgment module: the device is used for calculating the weight similarity between the real-time weighted structure chart of the application cluster at the current moment and the weighted structure chart of the last sampling point, judging whether the weight similarity is greater than a set similarity threshold value, and if so, continuously judging whether the real-time weighted structure chart at the current moment is similar to the graph structure of the initial weighted structure chart through a graph structure similarity judging module; otherwise, marking the abnormal component through an abnormal marking module; the process of judging whether the real-time weighted structure chart of the application cluster is similar in weight value comprises the following steps:
1. and (3) setting the weight information omega in the edge weight key value pair provided by each service component as { latency:0, CPU:0, mem:0, disk:0, net:0, extracting;
2. calculating the similarity between the real-time weighted structure diagram at the current moment and the weighted structure diagram at the last sampling point, and judging whether the similarity between the real-time weighted structure diagram at the current moment and the weighted structure diagram at the last sampling point is greater than a set similarity threshold value or not, if the last sampling point is the initial moment, or if the similarity is greater than the set similarity threshold value, obtaining the weighted structure diagram of the real-time weighted structure1，G2) If the similarity is greater than the set similarity threshold, returning the information that the weight is normal; if Sim (G)1，G2) And if the similarity is less than the set similarity threshold, returning to the application cluster structure chart that the weight is abnormal, and returning to the side with the diff value less than the threshold.
In the above, the similarity calculation method is:
in the formula (1), G1，G2Respectively showing a real-time weighted structure chart of the current moment and a weighted structure chart of a last sampling point,
e represents G1And G2And concentrated edge, ω1，ω2Indicating that the edges e are respectively at G1And G2The weight value in (1).
An exception marking module: the real-time weighting structure chart is used for screening the sides with the weight similarity smaller than the similarity threshold value, marking the sides in the real-time weighting structure chart at the current moment and returning the marked real-time weighting structure chart to the cluster manager; the method and the device for determining the cluster function are capable of judging whether the cluster function is abnormal or not by means of the weight value similarity of the real-time authorized structure diagram of the application cluster, and the speed of positioning the function abnormality is increased.
Fig. 6 is a schematic structural diagram of hardware equipment of a container cloud platform anomaly detection method provided in an embodiment of the present application. As shown in fig. 6, the device includes one or more processors and memory. Taking a processor as an example, the apparatus may further include: an input system and an output system.
The processor, memory, input system, and output system may be connected by a bus or other means, as exemplified by the bus connection in fig. 6.
The memory, which is a non-transitory computer readable storage medium, may be used to store non-transitory software programs, non-transitory computer executable programs, and modules. The processor executes various functional applications and data processing of the electronic device, i.e., implements the processing method of the above-described method embodiment, by executing the non-transitory software program, instructions and modules stored in the memory.
The memory may include a storage program area and a storage data area, wherein the storage program area may store an operating system, an application program required for at least one function; the storage data area may store data and the like. Further, the memory may include high speed random access memory, and may also include non-transitory memory, such as at least one disk storage device, flash memory device, or other non-transitory solid state storage device. In some embodiments, the memory optionally includes memory located remotely from the processor, and these remote memories may be connected to the processing system over a network. Examples of such networks include, but are not limited to, the internet, intranets, local area networks, mobile communication networks, and combinations thereof.
The input system may receive input numeric or character information and generate a signal input. The output system may include a display device such as a display screen.
The one or more modules are stored in the memory and, when executed by the one or more processors, perform the following for any of the above method embodiments:
step a: inputting an initial authorized structure chart of an application cluster, and constructing a real-time authorized structure chart of the application cluster;
step b: judging whether the real-time authorized structure chart of the application cluster is similar to the chart structure of the initial authorized structure chart or not, if so, considering the application cluster structure to be normal, and executing the step c; otherwise, returning the abnormal information of the application cluster structure;
step c: calculating the weight similarity of the real-time weighted structure chart of the application cluster at the current moment and the weighted structure chart of the last sampling point, judging whether the weight similarity is greater than a set similarity threshold value, if so, returning to the step b to continuously judge whether the real-time weighted structure chart at the current moment is similar to the graph structure of the initial weighted structure chart; otherwise, executing step d;
step d: and screening the sides with the weight similarity smaller than the similarity threshold, marking abnormal components in the real-time weighted structure chart at the current moment, and returning the marked real-time weighted structure chart to a cluster manager.
The product can execute the method provided by the embodiment of the application, and has the corresponding functional modules and beneficial effects of the execution method. For technical details that are not described in detail in this embodiment, reference may be made to the methods provided in the embodiments of the present application.
Embodiments of the present application provide a non-transitory (non-volatile) computer storage medium having stored thereon computer-executable instructions that may perform the following operations:
step a: inputting an initial authorized structure chart of an application cluster, and constructing a real-time authorized structure chart of the application cluster;
step b: judging whether the real-time authorized structure chart of the application cluster is similar to the chart structure of the initial authorized structure chart or not, if so, considering the application cluster structure to be normal, and executing the step c; otherwise, returning the abnormal information of the application cluster structure;
step c: calculating the weight similarity of the real-time weighted structure chart of the application cluster at the current moment and the weighted structure chart of the last sampling point, judging whether the weight similarity is greater than a set similarity threshold value, if so, returning to the step b to continuously judge whether the real-time weighted structure chart at the current moment is similar to the graph structure of the initial weighted structure chart; otherwise, executing step d;
step d: and screening the sides with the weight similarity smaller than the similarity threshold, marking abnormal components in the real-time weighted structure chart at the current moment, and returning the marked real-time weighted structure chart to a cluster manager.
Embodiments of the present application provide a computer program product comprising a computer program stored on a non-transitory computer readable storage medium, the computer program comprising program instructions that, when executed by a computer, cause the computer to perform the following:
step a: inputting an initial authorized structure chart of an application cluster, and constructing a real-time authorized structure chart of the application cluster;
step b: judging whether the real-time authorized structure chart of the application cluster is similar to the chart structure of the initial authorized structure chart or not, if so, considering the application cluster structure to be normal, and executing the step c; otherwise, returning the abnormal information of the application cluster structure;
step c: calculating the weight similarity of the real-time weighted structure chart of the application cluster at the current moment and the weighted structure chart of the last sampling point, judging whether the weight similarity is greater than a set similarity threshold value, if so, returning to the step b to continuously judge whether the real-time weighted structure chart at the current moment is similar to the graph structure of the initial weighted structure chart; otherwise, executing step d;
step d: and screening the sides with the weight similarity smaller than the similarity threshold, marking abnormal components in the real-time weighted structure chart at the current moment, and returning the marked real-time weighted structure chart to a cluster manager.
According to the container cloud platform anomaly detection method and system and the electronic device, structural similarity of the real-time authorized structure diagram of the application cluster is used for judging cluster structural anomaly, the number of times of similarity calculation is reduced, and the real-time performance of structural anomaly detection is improved. And judging whether the cluster function is abnormal or not by using the similarity of the weight values of the real-time structure chart of the application cluster, thereby improving the speed of positioning the function abnormality. According to the method and the device, the request response time is adopted for judging the abnormal state, so that the data acquisition overhead is reduced, and the instantaneity of judging the abnormal state is improved. Meanwhile, the interference between the assemblies and the interference between the physical machines and the assemblies are considered, and the abnormity is positioned from the two angles of the application cluster structure and the application cluster function, so that the accuracy of abnormity positioning is improved.
The previous description of the disclosed embodiments is provided to enable any person skilled in the art to make or use the present application. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the generic principles defined herein may be applied to other embodiments without departing from the spirit or scope of the application. Thus, the present application is not intended to be limited to the embodiments shown herein but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.
Claims (11)
1. A container cloud platform anomaly detection method is characterized by comprising the following steps:
step a: inputting an initial authorized structure chart of an application cluster, and constructing a real-time authorized structure chart of the application cluster;
step b: judging whether the real-time authorized structure chart of the application cluster is similar to the chart structure of the initial authorized structure chart or not, if so, considering the application cluster structure to be normal, and executing the step c; otherwise, returning the abnormal information of the application cluster structure;
step c: calculating the weight similarity of the real-time weighted structure chart of the application cluster at the current moment and the weighted structure chart of the last sampling point, judging whether the weight similarity is greater than a set similarity threshold value, if so, returning to the step b to continuously judge whether the real-time weighted structure chart at the current moment is similar to the graph structure of the initial weighted structure chart; otherwise, executing step d;
step d: and screening the sides with the weight similarity smaller than the similarity threshold, marking abnormal components in the real-time weighted structure chart at the current moment, and returning the marked real-time weighted structure chart to a cluster manager.
2. The method according to claim 1, wherein in the step a, the constructing a real-time authorized structure diagram of the application cluster specifically includes: and collecting calling information and response time among all server components in the application cluster and resource use information of the application components, and constructing a real-time authorized structure chart of the application cluster according to the calling information and the response time among all the server components and the resource use information of the application components.
3. The method according to claim 1 or 2, wherein in the step a, the real-time authorized structure diagram of the application cluster is constructed in a manner that:
step a 1: acquiring information of an application service component requesting to call a network card, recording a destination IP address requested by the service component when the network card is called by the service component, and recording a destination IP and a source IP;
step a 2: recording destination IP (dIP) and source IP (sIP) information, and respectively converting the destination IP and the source IP into a destination host name and a source host name according to host information, namely recording the names of service components as dName and sName respectively;
step a 3: adding service components represented by a target IP and a source IP into a real-time weighted structure diagram as vertexes, constructing structure diagram edge weight key value pairs < (sName: dName) > (latency: 0, CPU:0, mem:0, disk:0 and net: 0), representing that the connection of nodes of two service components is normal, wherein { latency:0, CPU:0, mem:0, disk:0 and net:0} represent edge weights, latency represents response time between the service components, CPU represents the CPU average utilization rate of the service components in a sampling period, mem represents the average utilization rate of a memory, disk represents the average disk read-write rate, and net represents the average network IO rate;
step a 4: recording service response time between the service component and a service component requested by the service component, taking the response time as a weight of the service component and the service component requested by the service component, replacing latency information of a middle weight of a real-time graph edge weight key value pair with a weight structure, acquiring resource use information of the service component by using a dockerAPI, and replacing CPU, mem, disk and net information of the middle weight of the key value pair;
step a 5: and returning the real-time graph edge weight key value pair with the weight structure to the main node.
4. The method according to claim 3, wherein in the step b, the step of determining whether the graph structures of the real-time authorized structure graph and the initial authorized structure graph of the application cluster are similar specifically includes:
step b 1: extracting the side information (sName: dName) in the side weight key value pair provided by each service component;
step b 2: sequencing the side information according to the source host name sName;
step b 3: comparing the sequencing result of the side information with a side information sequence in the initial structure drawing with the right, judging whether the source host and the target host do not correspond one by one, if so, returning the information of the sides of the cluster with abnormal structures and different from the initial structure drawing with the right; otherwise, returning the normal information of the cluster structure.
5. The method according to claim 4, wherein in the step c, the determining whether the weight similarity is greater than a set similarity threshold specifically includes:
step c 1: and (3) setting the weight information omega in the edge weight key value pair provided by each service component as { latency:0, CPU:0, mem:0, disk:0, net:0, extracting;
step b 2: calculating the similarity between the real-time weighted structure diagram at the current moment and the weighted structure diagram of the last sampling point, wherein the calculation formula is as follows:
in the above formula, G1，G2Respectively showing a real-time weighted structure chart of the current moment and a weighted structure chart of a last sampling point,
e represents G1And G2Andconcentrated edge, ω1，ω2Indicating that the edges e are respectively at G1And G2The weight value in (1);
step b 3: judging whether the similarity between the real-time weighted structure diagram at the current moment and the weighted structure diagram at the last sampling point is greater than a set similarity threshold value, if the last sampling point is the initial moment, or if the similarity is greater than the set similarity threshold value, judging whether the similarity is greater than the set similarity threshold value or not, if the similarity is greater than the set similarity threshold value, judging whether the similarity is greater1，G2) If the similarity is greater than the set similarity threshold, returning the information that the weight is normal; if Sim (G)1，G2) And if the similarity is less than the set similarity threshold, returning to the application cluster structure chart that the weight is abnormal, and returning to the side with the diff value less than the threshold.
6. A container cloud platform anomaly detection system, comprising:
an initialization module: the initial authorized structure chart is used for inputting an application cluster;
a structure diagram construction module: the real-time authorized structure chart is used for constructing an application cluster;
the graph structure similarity judging module: the weight similarity judging module is used for judging whether the real-time weighted structure chart of the application cluster is similar to the graph structure of the initial weighted structure chart, if so, the application cluster structure is considered to be normal, and the weight similarity of the real-time weighted structure chart is judged through the weight similarity judging module; otherwise, returning the abnormal information of the application cluster structure;
a weight similarity judgment module: the device is used for calculating the weight similarity between the real-time weighted structure diagram of the application cluster at the current moment and the weighted structure diagram of the last sampling point, judging whether the weight similarity is greater than a set similarity threshold value, and if so, continuously judging whether the real-time weighted structure diagram at the current moment is similar to the diagram structure of the initial weighted structure diagram through the diagram structure similarity judging module; otherwise, marking the abnormal component through an abnormal marking module;
an exception marking module: and the method is used for screening the sides with the weight similarity smaller than the similarity threshold, marking abnormal components in the real-time weighted structure chart at the current moment, and returning the marked real-time weighted structure chart to the cluster manager.
7. The system for detecting the anomaly of the container cloud platform according to claim 6, wherein the construction of the real-time authorized structure diagram of the application cluster by the structure diagram construction module specifically comprises: and collecting calling information and response time among all server components in the application cluster and resource use information of the application components, and constructing a real-time authorized structure chart of the application cluster according to the calling information and the response time among all the server components and the resource use information of the application components.
8. The system for detecting the anomaly of the container cloud platform according to claim 6 or 7, wherein the construction of the real-time authorized structure diagram of the application cluster by the structure diagram construction module specifically comprises:
acquiring information of an application service component requesting to call a network card, recording a destination IP address requested by the service component when the network card is called by the service component, and recording a destination IP and a source IP;
recording destination IP (dIP) and source IP (sIP) information, and respectively converting the destination IP and the source IP into a destination host name and a source host name according to host information, namely recording the names of service components as dName and sName respectively;
adding service components represented by a target IP and a source IP into a real-time weighted structure diagram as vertexes, constructing structure diagram edge weight key value pairs < (sName: dName) > (latency: 0, CPU:0, mem:0, disk:0 and net: 0), representing that the connection of nodes of two service components is normal, wherein { latency:0, CPU:0, mem:0, disk:0 and net:0} represent edge weights, latency represents response time between the service components, CPU represents the CPU average utilization rate of the service components in a sampling period, mem represents the average utilization rate of a memory, disk represents the average disk read-write rate, and net represents the average network IO rate;
recording service response time between the service component and the service component requested by the service component, taking the response time as a weight of the service component and the service component requested by the service component, replacing latency information of a middle weight of a real-time graph edge weight key value pair, acquiring resource use information of the service component by using dockeraPI, replacing CPU, mem, disk and net information of the middle weight of the key value pair, and returning the real-time graph edge weight key value pair of the right structure to the main node.
9. The system according to claim 8, wherein the determining whether the graph structure similarity between the real-time authorized structure graph of the application cluster and the initial authorized structure graph is similar comprises:
extracting the side information (sName: dName) in the side weight key value pair provided by each service component; sequencing the side information according to the source host name sName;
comparing the sequencing result of the side information with a side information sequence in the initial structure drawing with the right, judging whether the source host and the target host do not correspond one by one, if so, returning the information of the sides of the cluster with abnormal structures and different from the initial structure drawing with the right; otherwise, returning the normal information of the cluster structure.
10. The system according to claim 9, wherein the determining whether the weight similarity is greater than a set similarity threshold by the weight similarity determination module specifically comprises: and (3) setting the weight information omega in the edge weight key value pair provided by each service component as { latency:0, CPU:0, mem:0, disk:0, net:0, extracting; calculating the similarity between the real-time weighted structure diagram at the current moment and the weighted structure diagram of the last sampling point, wherein the calculation formula is as follows:
in the above formula, G1，G2Respectively showing a real-time weighted structure chart of the current moment and a weighted structure chart of a last sampling point,
e represents G1And G2And concentrated edge, ω1，ω2Indicating that the edges e are respectively at G1And G2The weight value in (1);
judging whether the similarity between the real-time weighted structure diagram at the current moment and the weighted structure diagram at the last sampling point is greater than a set similarity threshold value, if the last sampling point is the initial moment, or if the similarity is greater than the set similarity threshold value, judging whether the similarity is greater than the set similarity threshold value or not, if the similarity is greater than the set similarity threshold value, judging whether the similarity is greater1，G2) If the similarity is greater than the set similarity threshold, returning the information that the weight is normal; if Sim (G)1，G2) And if the similarity is less than the set similarity threshold, returning to the application cluster structure chart that the weight is abnormal, and returning to the side with the diff value less than the threshold.
11. An electronic device, comprising:
at least one processor; and
a memory communicatively coupled to the at least one processor; wherein the content of the first and second substances,
the memory stores instructions executable by the at least one processor to enable the at least one processor to perform the following operations of the container cloud platform anomaly detection method of any one of items 1 to 5 above:
step a: inputting an initial authorized structure chart of an application cluster, and constructing a real-time authorized structure chart of the application cluster;
step b: judging whether the real-time authorized structure chart of the application cluster is similar to the chart structure of the initial authorized structure chart or not, if so, considering the application cluster structure to be normal, and executing the step c; otherwise, returning the abnormal information of the application cluster structure;
step c: calculating the weight similarity of the real-time weighted structure chart of the application cluster at the current moment and the weighted structure chart of the last sampling point, judging whether the weight similarity is greater than a set similarity threshold value, if so, returning to the step b to continuously judge whether the real-time weighted structure chart at the current moment is similar to the graph structure of the initial weighted structure chart; otherwise, executing step d;
step d: and screening the sides with the weight similarity smaller than the similarity threshold, marking abnormal components in the real-time weighted structure chart at the current moment, and returning the marked real-time weighted structure chart to a cluster manager.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201911233197.2A CN111061586B (en) | 2019-12-05 | 2019-12-05 | Container cloud platform anomaly detection method and system and electronic equipment |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201911233197.2A CN111061586B (en) | 2019-12-05 | 2019-12-05 | Container cloud platform anomaly detection method and system and electronic equipment |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN111061586A true CN111061586A (en) | 2020-04-24 |
| CN111061586B CN111061586B (en) | 2023-09-19 |
Family
ID=70299690
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201911233197.2A Active CN111061586B (en) | 2019-12-05 | 2019-12-05 | Container cloud platform anomaly detection method and system and electronic equipment |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN111061586B (en) |
Citations (10)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| GB201219365D0 (en) * | 2012-10-26 | 2012-12-12 | Ibm | Method for determining system topology graph changes in a distributed computing system |
| CN103888304A (en) * | 2012-12-19 | 2014-06-25 | 华为技术有限公司 | Abnormity detection method of multi-node application and related apparatus |
| CN103902988A (en) * | 2014-04-21 | 2014-07-02 | 梁爽 | Method for rough draft shape matching based on Modular product graph and maximum clique |
| CN105469376A (en) * | 2014-08-12 | 2016-04-06 | 腾讯科技（深圳）有限公司 | Method and device for determining picture similarity |
| CN106385343A (en) * | 2016-09-05 | 2017-02-08 | Tcl集团股份有限公司 | Method and device for monitoring client in distributed system, and distributed system |
| CN109214456A (en) * | 2018-09-06 | 2019-01-15 | 深圳先进技术研究院 | A kind of network anomaly detection method, system and electronic equipment |
| CN109586999A (en) * | 2018-11-12 | 2019-04-05 | 深圳先进技术研究院 | A kind of container cloud platform condition monitoring early warning system, method and electronic equipment |
| CN109800052A (en) * | 2018-12-15 | 2019-05-24 | 深圳先进技术研究院 | Abnormality detection and localization method and device applied to distributed container cloud platform |
| CN109840533A (en) * | 2017-11-28 | 2019-06-04 | 中国移动通信集团浙江有限公司 | A kind of applied topology figure recognition methods and device |
| CN110290012A (en) * | 2019-07-03 | 2019-09-27 | 浪潮云信息技术有限公司 | The detection recovery system and method for RabbitMQ clustering fault |
-
2019
- 2019-12-05 CN CN201911233197.2A patent/CN111061586B/en active Active
Patent Citations (10)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| GB201219365D0 (en) * | 2012-10-26 | 2012-12-12 | Ibm | Method for determining system topology graph changes in a distributed computing system |
| CN103888304A (en) * | 2012-12-19 | 2014-06-25 | 华为技术有限公司 | Abnormity detection method of multi-node application and related apparatus |
| CN103902988A (en) * | 2014-04-21 | 2014-07-02 | 梁爽 | Method for rough draft shape matching based on Modular product graph and maximum clique |
| CN105469376A (en) * | 2014-08-12 | 2016-04-06 | 腾讯科技（深圳）有限公司 | Method and device for determining picture similarity |
| CN106385343A (en) * | 2016-09-05 | 2017-02-08 | Tcl集团股份有限公司 | Method and device for monitoring client in distributed system, and distributed system |
| CN109840533A (en) * | 2017-11-28 | 2019-06-04 | 中国移动通信集团浙江有限公司 | A kind of applied topology figure recognition methods and device |
| CN109214456A (en) * | 2018-09-06 | 2019-01-15 | 深圳先进技术研究院 | A kind of network anomaly detection method, system and electronic equipment |
| CN109586999A (en) * | 2018-11-12 | 2019-04-05 | 深圳先进技术研究院 | A kind of container cloud platform condition monitoring early warning system, method and electronic equipment |
| CN109800052A (en) * | 2018-12-15 | 2019-05-24 | 深圳先进技术研究院 | Abnormality detection and localization method and device applied to distributed container cloud platform |
| CN110290012A (en) * | 2019-07-03 | 2019-09-27 | 浪潮云信息技术有限公司 | The detection recovery system and method for RabbitMQ clustering fault |
Also Published As
| Publication number | Publication date |
|---|---|
| CN111061586B (en) | 2023-09-19 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| US10693711B1 (en) | Real-time event correlation in information networks | |
| US10599506B2 (en) | Methods and systems for identifying action for responding to anomaly in cloud computing system | |
| US10284623B2 (en) | Optimized browser rendering service | |
| US20190361690A1 (en) | Extensions for deployment patterns | |
| US10834183B2 (en) | Managing idle and active servers in cloud data centers | |
| US20130275970A1 (en) | Interactive search monitoring in a virtual machine environment | |
| US11106562B2 (en) | System and method for detecting anomalies based on feature signature of task workflows | |
| US9400731B1 (en) | Forecasting server behavior | |
| Patel et al. | Machine learning based statistical prediction model for improving performance of live virtual machine migration | |
| Caglar et al. | Intelligent, performance interference-aware resource management for iot cloud backends | |
| EP2634699B1 (en) | Application monitoring | |
| US10944778B1 (en) | Method and system for implementing risk based cyber security | |
| WO2020119627A1 (en) | Abnormality detection and positioning method and apparatus applied to distributed container cloud platform | |
| US20160112285A1 (en) | Apparatus and method for detecting abnormal connection | |
| EP4152715A1 (en) | Method and apparatus for determining resource configuration of cloud service system | |
| US11334461B2 (en) | Distributed application resource determination based on performance metrics | |
| CN111061586B (en) | Container cloud platform anomaly detection method and system and electronic equipment | |
| CN115080397A (en) | System reliability testing method, device, equipment and storage medium | |
| US11467947B2 (en) | Automated mocking of computer system deployments | |
| CN112306639B (en) | Virtual desktop testing method and device | |
| CN113010268B (en) | Malicious program identification method and device, storage medium and electronic equipment | |
| WO2021109048A1 (en) | Container cloud platform abnormality detection method and system, and electronic device | |
| US11196766B2 (en) | Detecting denial of service attacks in serverless computing | |
| US11050768B1 (en) | Detecting compute resource anomalies in a group of computing resources | |
| US11968086B1 (en) | Isolated environment provisioning in service mesh-based microservices systems |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |